The Stingray surveillance technology, also called cell-site simulator technology, can gather a significant amount of personal data from individuals’ cellphones. A recent federal case in New York and a new law in Illinois aim to curtail the warrantless use of Stingrays.

The technology simulates a cellphone tower so that nearby mobile devices will connect to it and reveal sensitive personal data, such as their location, text messages, voice calls, and other information. The Stingray surveillance technology vacuums information from every cellphone within its range, so innocent people’s private data are gathered, as well. It is a dragnet that can capture hundreds of innocent people, rather than just the suspect targeted.

As I have discussed before, law enforcement officials are using this technology in secret. Documents obtained by the ACLU showed that the U.S. Marshals Service directed Florida police to hide the use of Stingray surveillance technology from judges, which meant the police lied in court documents. Sarasota police Sgt. Kenneth Castro sent an e-mail in April 2009 to colleagues at the North Port (Florida) Police Department: “In reports or depositions we simply refer to the assistance as ‘received information from a confidential source regarding the location of the suspect.’” A recent San Diego Union-Tribuneinvestigation showed that local police are using the surveillance technology in routine investigations – not ones involving terrorism or national security.

Now, a federal judge in New York has thrown out Stingray evidence gathered without a warrant. The case is United States v. Lambis (pdf) in the Southern District of New York. Without a warrant, the Drug Enforcement Administration used a powerful cell-site simulator to determine the location of a cellphone was in Raymond Lambis’s home. Agents then searched his home and found drugs and drug paraphernalia.

U.S. District Judge William Pauley looked to the 2001 Kyllo decision to rule against the DEA in this case. In Kyllo v. United States, 533 U.S. 27 (2001), the Supreme Court held that law enforcement use of a thermal imaging device to surveil and gather details about a private home is a “search” under the Fourth Amendment and presumptively unreasonable without a warrant. Scalia’s opinion said, “in the sanctity of the home, all details are intimate details,” and he noted the concern that technological advances would leave the homeowner at the mercy of “imaging technology that could discern all human activity in the home.” In Kyllo, the fact that the technology was “not in general public use” was important, as was the fact that the technology found “details of the home that would previously have been unknowable without physical intrusion.

In Lambis, Judge Pauley found that the DEA’s warrantless use of a cell-site simulator was the same unconstitutional search as the warrantless use of the imaging technology in Kyllo – a device not in general public use was deployed to determine details of the defendant’s home, details that would not have been learned, absent the technology, unless an agent entered the home. Judge Pauley wrote, “The use of a cell-site simulator constitutes a Fourth Amendment search within the contemplation of Kyllo. Absent a search warrant, the Government may not turn a citizen’s cell phone into a tracking device.” He ruled to suppress the evidence gained through the warrantless use of the Stingray. This decision is a first in the federal courts, and it is a significant one for privacy rights. (In March, an appeals court in Maryland upheld a lower-court ruling to toss evidence gathered through the warrantless use of a Stingray.)

Another important win for privacy rights is a recent law passed with strong bipartisan support in Illinois restricting the use of cell-site simulator technology, the latest of such laws in the states. The new Illinois law, and other states’ laws on cell-site simulator technology, sets out prohibitions on the warrantless use of this technology, with some exceptions. The laws are similar to the policies that the federal departments of Justice and Homeland Security (pdf) switched to last year, after public and Congressional scrutiny of the use of the surveillance technology. It is important that such restrictions are set out in laws, because the federal policies are 1) policies that can be changed at any time, and 2) apply only to federal law enforcement officials, not local or state officials.

There needs to be more legal restrictions on the use of cell-site simulator technology. The states are working on it and passing some laws. Congress has not. Last year, Rep. Jason Chaffetz (R-Utah) introduced a bill, H.R. 3871, The Stingray Privacy Act (pdf), to limit the use of cellphone surveillance technology known as cell-site simulators or “Stingray” technology. But it did not get out of committee.

Congress and state legislators need to pass laws protecting individuals’ privacy rights when it comes to such invasive surveillance technology. At a minimum, there needs to be a warrant requirement, based on probable cause, for the use of cell-site simulator technology, as well as minimization of data collection and use. Data minimization means the time period for the use of the Stingray surveillance technology should be limited, and officials should immediately delete the data collected on all devices that are not covered by the warrant – the data from individuals who are not suspects.